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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 {Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the U.S. Customs and Border Protection's 
(CBP) FY 2007 Internal Controls. It is based on interviews with employees and officials of relevant 
agencies and institutions, direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 
have been discussed in draft with those responsible for implementation. It is our hope that this 
report will result in more effective, efficient, and economical operations. We express our 
appreciation to all of those who contributed to the preparation of this report. 



Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Independent Auditors' Report 
Inspector General 

U.S. Department of Homeland Security: 
Commissioner 

U.S. Customs and Border Protection: 

We have audited the accompanying consolidated balance sheets of the U.S. Department of Homeland 
Security's (DHS) Customs and Border Protection (CBP) as of September 30, 2007 and 2006, and the 
related consolidated statements of net cost, changes in net position, and custodial activity, and combined 
statements of budgetary resources (hereinafter referred to as "consolidated financial statements") for the 
years then ended. The objective of our audits was to express an opinion on the fair presentation of these 
consolidated financial statements. In connection with our fiscal year 2007 audit, we also considered 
CBP's internal controls over financial reporting and performance measures and tested CBP's compliance 
with certain provisions of applicable laws, regulations, and contracts agreements that could have a direct 
and material effect on these consolidated financial statements. 

SUMMARY 

As stated in our opinion on the consolidated financial statements, we concluded that CBP's consolidated 
financial statements as of and for the years ended September 30, 2007 and 2006, are presented fairly, in 
all material respects, in conformity with U.S. generally accepted accounting principles. 

As discussed in Note 1 to the consolidated financial statements, CBP changed its method of reporting the 
reconciliation of budgetary resources obligated to the net cost of operations in fiscal year 2007. 

Our consideration of internal control over financial reporting resulted in the following conditions being 
identified as significant deficiencies: 

1 . Drawback of Duties, Taxes, and Fees 

2. Information Technology 

3. Entry Process 

• Compliance Measurement Program 

• Bonded Warehouse and Foreign Trade Zones 

• In-Bond Program 

• Continued Dumping and Subsidy Offset Act of 2000 (CDSOA) Refunds 

We consider the first two significant deficiencies, above, to be material weaknesses. 

We noted no deficiencies involving the design of the internal control over the existence and completeness 
assertions related to key performance measures. 

The results of our tests of compliance with certain provisions of laws, regulations, and contract 
agreements disclosed the following instances of noncompliance or other matters that are required to be 
reported under Government Auditing Standards, issued by the Comptroller General of the United States, 




and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal 
Financial Statements. 

• Federal Information Security Management Act (Electronic Government Act of 2002) 

• Federal Financial Management Improvement Act of 1 996 (FFMIA) 

The following sections discuss our opinion on CBP's consolidated financial statements; our consideration 
of CBP's internal controls over financial reporting and performance measures; our tests of CBP's 
compliance with certain provisions of applicable laws, regulations, and contract agreements; and 
management's and our responsibilities. 

OPINION ON THE FINANCIAL STATEMENTS 

We have audited the accompanying consolidated balance sheets of the U.S. Department of Homeland 
Security's (DHS) Customs and Border Protection (CBP) as of September 30, 2007 and 2006, and the 
related consolidated statements of net cost, changes in net position, and custodial activity, and the 
combined statements of budgetary resources for the years then ended. 

In our opinion, the consolidated financial statements referred to above present fairly, in all material 
respects, the financial position of CBP as of September 30, 2007 and 2006, and its net costs, changes in 
net position, budgetary resources, and custodial activity for the years then ended, in conformity with U.S. 
generally accepted accounting principles. 

As discussed in Note 1 to the consolidated financial statements, CBP changed its method of reporting the 
reconciliation of budgetary resources obligated to the net cost of operations in fiscal year 2007. 

The information in the Management Discussion and Analysis and Required Supplementary Information 
sections is not a required part of the consolidated financial statements, but is supplementary information 
required by U.S. generally accepted accounting principles and OMB Circular No. A- 136, Financial 
Reporting Requirements. We have applied certain limited procedures, which consisted principally of 
inquiries of management regarding the methods of measurement and presentation of this information. 
However, we did not audit this information and, accordingly, we express no opinion on it. 

Our audits were conducted for the puipose of forming an opinion on the consolidated financial statements 
taken as a whole. The information in the Performance Results section and Other Accompany Information 
section are presented for purposes of additional analysis and are not required as part of the consolidated 
financial statements. This information has not been subjected to auditing procedures and, accordingly, we 
express no opinion on it. 

INTERNAL CONTROL OVER FINANCIAL REPORTING 

Our consideration of the internal control over financial reporting was for the limited puipose described in 
the Responsibilities section of this report and would not necessarily identify all deficiencies in the internal 
control over financial reporting that might be significant deficiencies or material weaknesses. 

A control deficiency exists when the design or operation of a control does not allow management or 
employees, in the normal course of performing their assigned functions, to prevent or detect 
misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of 
control deficiencies, that adversely affects CBP's ability to initiate, authorize, record, process, or report 
financial data reliably in accordance with U.S. generally accepted accounting principles such that there is 
more than a remote likelihood that a misstatement of CBP's consolidated financial statements that is more 
than inconsequential will not be prevented or detected by CBP's internal control over financial reporting. 



A material weakness is a significant deficiency, or combination of significant deficiencies, that results in 
more than a remote likelihood that a material misstatement of the financial statements will not be 
prevented or detected by CBP's internal control. 

In our fiscal year 2007 audit, we consider the deficiencies, described in Exhibits I and II, to be significant 
deficiencies in internal control over financial reporting. However, of the significant deficiencies 
described in Exhibits I and II, we believe that the significant deficiencies presented in Exhibit I are 
material weaknesses. Exhibit IV presents the status of prior year reportable conditions. 

INTERNAL CONTROL OVER PERFORMANCE MEASURES 

Our tests of internal control over performance measures, as described in the Responsibilities section of 
this report, disclosed no deficiencies involving the design of the internal control over the existence and 
completeness assertions related to key performance measures. 

COMPLIANCE AND OTHER MATTERS 

Our tests of compliance with certain provisions of laws, regulations, and contract agreements, as 
described in the Responsibilities section of this report, exclusive of those referred to in the Federal 
-Financial Management Improvement Act of 1996 (FFMIA), disclosed one instance of noncompliance or 
other matters that are required to be reported herein under Government Auditing Standards or OMB 
Bulletin No. 07-04, and is described m Exhibit III. 

The results of our tests of FFMIA disclosed instances, described in Exhibit III, in which CBP's financial 
systems did not substantially comply with Federal financial management system requirements, and were 
not compliant with the United States Standard General Ledger at the transaction level. 

The results of our tests of FFMIA disclosed no instances in which CBP's financial management systems 
did not substantially comply with Federal accounting standards. 

We have noted certain additional matters that we have reported in the DHS Consolidated management 
letter. 

RESPONSIBILITIES 

Management's Responsibilities. The United States Code Title 31 Section 3515 and 9106 require 
agencies to report annually to Congress on their financial status and any other information needed to 
fairly present their financial position and results of operations. To meet these reporting requirements, the 
[Entity] prepares and submits financial statements in accordance with OMB Circular No. A- 13 6. 

Management is responsible for the consolidated financial statements, including: 

• Preparing the consolidated financial statements in conformity with U.S. generally accepted 
accounting principles; 

• Preparing the Management Discussion and Analysis (Including the performance measures) and 
Required Supplementary Information; 

• Establishing and maintaining effective internal control; and 



• Complying with laws, regulations, and contracts agreements applicable to CBP, including FFMIA. 

In fulfilling this responsibility, management is required to make estimates and judgments to assess the 
expected benefits and related costs of internal control policies. 

Auditors' Responsibilities. Our responsibility is to express an opinion on the fiscal year 2007 and 2006 
consolidated financial statements of CBP based on our audits. We conducted our audits in accordance 
with auditing standards generally accepted in the United States of America, the standards applicable to 
financial audits contained in Government Auditing Standards, issued by the Comptroller General of the 
United States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 require that 
we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial 
statements are free of material misstatement. An audit includes consideration of internal control over 
financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but 
not for the purpose of expressing an opinion on the effectiveness of CBP's internal control over financial 
reporting. Accordingly, we express no such opinion. 

An audit also includes: 

• Examining, on a test basis, evidence supporting the amounts and disclosures in the consolidated 
financial statements; 

• Assessing the accounting principles used and significant estimates made by management; and 

• Evaluating the overall consolidated financial statement presentation. 
We believe that our audits provide a reasonable basis for our opinion. 

In planning and performing our fiscal year 2007 audit, we considered CBP's internal control over 
financial reporting by obtaining an understanding of CBP's internal control, determining whether internal 
controls had been placed in operation, assessing control risk, and performing tests of controls as a basis 
for designing our auditing procedures for the puipose of expressing our opinion on the consolidated 
financial statements. We limited our internal control testing to those controls necessary to achieve the 
objectives described in Government Auditing Standards and OMB Bulletin No. 07-04. We did not test all 
internal controls relevant to operating objectives as broadly defined by the Federal Managers Financial 
Integrity Act of 1982. The objective of our audit was not to express an opinion on the effectiveness of 
CBP's internal control over financial reporting. Accordingly, we do not express an opinion on the 
effectiveness of CBP's internal control over financial reporting. 

As required by OMB Bulletin No. 07-04 in our fiscal year 2007 audit, with respect to internal control 
related to performance measures determined by management to be key and reported in the Management 
Discussion and Analysis and Performance sections, we obtained an understanding of the design of 
internal controls relating to the existence and completeness assertions and determined whether these 
internal controls had been placed in operation. We limited our testing to those controls necessary to 
report deficiencies in the design of internal control over key performance measures in accordance with 
OMB Bulletin 07-04. However, our procedures were not designed to provide an opinion on internal 
control over reported performance measures and, accordingly, we do not provide an opinion thereon. 

As part of obtaining reasonable assurance about whether CBP's fiscal year 2007 consolidated financial 
statements are free of material misstatement, we performed tests of CBP's compliance with certain 
provisions of laws, regulations, and contract agreements, noncompliance with which could have a direct 



and material effect on the determination of the consolidated financial statement amounts, and certain 
provisions of other laws and regulations specified in OMB Bulletin No. 07-04, including certain 
provisions referred to in FFMIA. We limited our tests of compliance to the provisions described in the 
preceding sentence, and we did not test compliance with all laws, regulations, and contract agreements 
applicable to CBP. However, providing an opinion on compliance with laws, regulations, and contract 
agreements was not an objective of our audit and, accordingly, we do not express such an opinion. 

Under OMB Bulletin No. 07-04 and FFMIA, we are required to report whether CBP's financial 
management systems substantially comply with (1) Federal financial management systems requirements, 
(2) applicable Federal accounting standards, and (3) the United States Government Standard General 
Ledger at the transaction level. To meet this requirement, we performed tests of compliance with FFMIA 
Section 803(a) requirements. 



CBP's responses to the findings identified in our audit are presented in Exhibits I, II, III. We did not 
audit CBP's response and, accordingly, we express no opinion on it. 

This report is intended solely for the information and use of the CBP's management, DHS management, 
the DHS Office of the Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. 
Congress and is not intended to be and should not be used by anyone other than these specified parties. 

KZptM& lcp 



November 13, 2007 
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Material Weaknesses 

A. Drawback of Duties, Taxes and Fees 

Background: 

CBP, as a component of DHS, continued to perform an important revenue collection function for the U.S. 
Treasury. CBP collects approximately $30 billion in import duties, taxes and fees annually on 
merchandise arriving in the United States from foreign countries. 

Drawback is a remittance in whole or in part, of duties, taxes, or fees previously paid by an importer. 
Drawback typically occurs when the imported goods on which duties, taxes, or fees have been previously 
paid are subsequently exported from the United States or destroyed prior to entering the commerce of the 
United States. Depending on the type of drawback claim, the claimant has up to eight years from the date 
of importation to file for drawback. At the end of FY 2005, the U.S. Congress enacted the Miscellaneous 
Trade and Technical Corrections Act of 2004 (Public Law 108-429) that stipulated the timeframe for 
liquidating claims; this new process is known as deemed-liquidation by CBP. As a result of the new 
deemed-liquidation process, CBP implemented new policies and procedures during FY 2006 that require 
the payment of claims in an accelerated timeframe. 

Condition: 

We noted the following weaknesses related to internal controls over drawback of duties, taxes, and fees 
paid by the importer: 

• The Automated Commercial System (ACS) lacked automated controls to detect and prevent 
excessive drawback claims and payments, necessitating inefficient manual processes that do 
not effectively compensate for the lack of automated controls. ACS did not have the 
capability to compare, verify, and track essential information on drawback claims to the 
related underlying consumption entries or export documentation upon which the drawback 
claim was based. For example, ACS did not contain electronic edit checks that would flag 
duplicate claims for export of the same merchandise; 

• In addition, we noted that ACS lacked controls to prevent overpayment of drawback claims at 
the summary line level that were subject to the deemed liquidation process put in place during 
FY 2006. Specifically, we noted approximately $8K of overpayments. CBP does not have 
the capability to determine the total drawback overpayments as the result of deemed- 
liquidation; 

• Drawback review policies did not require drawback specialists to review all or a statistically 
valid sample of prior drawback claims against the underlying consumption entries (UCE) to 
determine whether, in the aggregate, an excessive amount was claimed. CBP has no 
absolute assurance that a selected import entry is not being over-claimed by different 
drawback claims; 

• CBP drawback review policy and procedures allowed drawback specialists, with supervisory 
approval, to judgmentally decrease the number of ACS selected UCEs randomly selected for 
review, thus decreasing the review's effectiveness. Further, CBP implemented a new 
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sampling methodology for selecting UCEs, however, the methodology is not considered to be 
statistically valid; and 

• The initial period for document retention related to a drawback claim is only 3 years from the 
date of payment. However, there are several situations that could extend the life of the 
drawback claim well beyond those 3 years. 

Cause/Effect: 

Much of the drawback process was manual, placing an added burden on limited resources. CBP did use a 
sampling approach to compare, verify, and match consumption entry and export documentation to 
drawback claims submitted by importers. However, system and procedural limitations decreased the 
effectiveness of this approach. The inherent risk of fraudulent claims or claims made in error was high, 
which increased the risk of erroneous payments. 

Criteria: 

Under the Federal Managers Financial Integrity Act (FMFIA), management must implement cost- 
effective controls to safeguard assets and ensure reliable financial reporting. Office of Management and 
Budget (OMB)'s Revised Implementation Guidance for the Federal Financial Management Improvement 
Act states that financial systems should "routinely provide reliable financial information consistently, 
accurately, and reported uniformly" to support management of current operations. Joint Financial 
Management Improvement Program (JFMIP) publications and OMB Circular A- 127, Financial 
Management Systems, outlines the requirements for Federal systems. JFMIP's Core Financial System- 
Requirements states that the core financial system must maintain detailed information by account 
sufficient to provide audit trails and to support billing and research activities. OMB Circular A- 127 
requires that the design of financial systems should eliminate unnecessary duplication of a transaction 
entry. Whenever appropriate, data needed by the systems to support financial functions should be entered 
only once and other parts of the system should be updated through electronic means consistent with the 
timing requirements of normal business/transaction cycles. 

The Improper Payments Information Act of 2002 requires agencies to assess the risk of erroneous 
payments and develop a plan to correct control weaknesses. In addition to the legal requirements stated 
above, CBP's Drawback Handbook, dated March 2007, states that management reviews are necessary to 
maintain a uniform national policy of supervisory review. 

Recommendations: 

We recommend that CBP: 

1. Implement effective internal controls over drawback claims as part of any new systems 
initiatives, including the ability to compare, verify, and track essential information on drawback 
claims to the related underlying consumption entries and export documentation for which the 
drawback claim is based, and identify duplicate or excessive drawback claims; 

2. Implement automated controls within ACS to prevent overpayment of a drawback claim that is 
subject to deemed-liquidation; 
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3. While the Automated Commercial Environment (ACE) is in development, we recommend that 
CBP collaborate with ACE developers/engineers to ensure that the new system eliminates the 
need for statistical sampling of UCEs and prior related drawback claims as drawback claims. 
In addition, until ACE is implemented, we recommend that CBP explore other statistical 
approaches for selecting UCEs and prior related drawback claims under the current ACS 
environment; and 

4. Continue to work with the U.S. Congress to lengthen the required document retention period 
for all supporting documentation so that it corresponds with the drawback claim life cycle. 

CBP Response: 

See management's response included in the attached letter. 



B. Information Technology 
Background: 

Controls over information technology (IT) and related financial systems are essential elements of 
financial reporting integrity. Effective general controls in an IT and financial systems environment are 
typically defined in six key control areas: entity- wide security program planning and management, access 
control, application software development and change control, system software, segregation of duties, and 
service continuity. In addition to reliable controls, financial management system functionality is important 
to program monitoring, increasing accountability of financial and program managers, providing better 
information for decision-making, and increasing the efficiency and effectiveness of services provided by 
the Federal government. 

Condition: 

During FY 2007, CBP took corrective actions to address prior year IT control weaknesses. However, 
during FY 2007, we continued to find IT general and application control weaknesses at CBP. The most 
significant weaknesses from a financial statement audit perspective relate to information security. 
Collectively, the IT control weaknesses limit CBP's ability to ensure that critical financial and operational 
data is maintained in such a manner as to ensure confidentiality, integrity, and availability. Because of the 
sensitive nature of the issues identified, we will issue a separate restricted distribution report to address 
those issues in detail. 

Criteria: 

The Federal Information Security Management Act (FISMA), passed as part of the E-Government Act of 
2002, mandates that Federal entities maintain IT security programs in accordance with OMB and National 
Institute of Standards and Technology (NIST) guidance. OMB Circular A- 130, Management of Federal 
Information Resources, and various NIST guidelines describe specific essential criteria for maintaining 
effective general IT controls. In addition, OMB Circular A- 127 prescribes policies and standards for 
executive departments and agencies to follow in developing, operating, evaluating, and reporting on 
financial management systems. 
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Recommend ation : 

Due to the sensitive nature of these findings, our separate report will recommend that CBP management 
implement and enforce certain procedures to address the general and application control vulnerability of 
its financial systems. 

CBP Response: 



See management's response included in the attached letter. 
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Other Significant Deficiencies 
C. Entry Process 

1. Compliance Measurement Program 
Background: 

CBP utilizes the Compliance Measurement (CM) program to measure the effectiveness of its control 
mechanisms over the collection of taxes, duties, and fees. The CM program is also used to determine the 
revenue gap that is reported in "Other Accompanying Information" in the financial statements. 

Condition: 

We noted the following weaknesses related to CBP's CM Program: 

• CM Coordinators' guidance related to sampling, review procedures, and documentation 
requirements is ineffective related to the monthly review of CM results completed by import 
specialists. CBP issued a memorandum to the ports addressing changes to the Compliance 
Measurement (CM) program. The memorandum included an updated Appendix B listing the 
responsibilities of various personnel within the CM process. Section 2.6 states that "On a 
monthly basis, the CM Coordinator will randomly sample the CM reviews completed by 
Import Specialists to verify that the reviews have been done in accordance with the 
procedures set forth herein." However, there is a weakness in the guidance in that it does not 
provide the CM Coordinators with a sampling methodology, required review procedures, and 
related documentation requirements for the monthly review; 

• Non-compliance with CM guidelines requiring periodic reviews at the port level. During FY 
2007, we noted that four CM Coordinators were not performing the monthly reviews of CM 
reviews performed by the Import Specialists as required in the memorandum discussed 
above. At an additional six sites, there was no documentation to confirm performance of the 
monthly reviews. In addition, we noted that at one site, the Compliance Review Tracking 
Quarterly (CRTQ) function was used to follow-up on Entry Summary CM selectivity hits; 
however, the CRTQ was not run weekly as required by Appendix B. Further at another port, 
the SSXM Coordinator position was left vacant for six months; consequently no cargo 
monitoring reports were run or reviewed during this time. During the review of entries 
identified on the various monitoring reports, we noted that sites selected for testing were not 
inputting Import Specialist Discrepancy Adjustment (ISDA) remarks in compliance with 
Directives 3550-074A (dated May 14, 2004) and 3550-074B (dated September 15, 2006) and 
Appendix B. We noted two different types of discrepancies from the guidelines noted above: 
ISDA remarks were entered beyond the 120 day requirement at six ports and the ISDA 
remarks did not provide sufficient detail at four ports; 

• The National Analysis Specialist Division (NASD) port audits were stopped during FY 2006. 
In prior years, NASD performed port audits to identify errors during the performance of a 
CM review. In fiscal year 2005, KPMG recommended using a risk-based approach to select 
which ports to audit. In addition, we recommended compiling the results of the port audits to 
identify potential trends or weaknesses on a national level, and to calculate a revenue impact 
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for the discrepancies noted. During FY 2007, CBP suspended the performance of port audits. 
Instead, CBP-HQ relies on the Self-Inspection program to determine how the ports are 
performing the CM examinations. We noted that questions on the self-inspection program 
worksheets do not provide the equivalent information that the twenty-five point port audit 
review provided; and 

• Untimely results of CM exams. The memorandum for CM changes noted in condition 1 
above includes an adjustment extending the deadline for ISDA comments from the Import 
Specialists to 120 days. Due to the extension in imputing results, CBP is unable to analyze 
the results of CM exams in a timely manner. 

We noted that the first three conditions above have been addressed by CBP in their prior year corrective 
action plan (CAP) submitted in response to CM findings from the FY2005 and FY2006 financial 
statement audits. We note that CBP is in the process of designing and implementing standardized web- 
based queries for CM coordinators to use on a monthly basis to verify that CM reviews have been 
completed in accordance with the procedures set forth in the CM guidelines. The queries in development 
are being designed to identify both missing SSXM and ISDA remarks. In addition, a query is being 
developed that will generate a statistically valid random sample of entry summary reviews for the CM 
coordinator to review each month. In addition to the standardized queries being developed at the port 
level, a series of queries will be run by the CM coordinator at HQ each month which will randomly select 
CM reviews performed nationwide to ensure that ports are in compliance with CM guidelines and 
requirements. CBP will release standard operating procedures (SOPs) to address each of these items. 

We noted that the proposed CM monitoring system will not be implemented until FY 2008. 
Cause/Effect: 

CBP has been challenged to balance its commitment of limited resources to two important mission 
objectives - trade compliance, including the collection of taxes, duties and fees owed to the Federal 
government, and securing the U.S. borders from potential terrorist entiy. While these mission objectives 
do overlap somewhat, there are differences in how resources are deployed. In fiscal year 2006, CBP 
made significant improvements in its custodial review controls and measurement processes, procedures 
and policies. 

The weaknesses in the CM program could result in CBP incorrectly evaluating the effectiveness of its 
control environment over the collections of duties, taxes, and fees. In addition, errors within the CM 
program could result in a misstatement of the "revenue gap" disclosure in the Management Discussion 
and Analysis section of CBP's Performance and Accountability Report. 

Recommendations: 

We recommend that CBP implement the following to improve the CM program: 

1 . Provide additional detail in the guidelines, specifying the sample size, procedures to perform, 
and documentation requirements for the CM Coordinator's review of Import Specialists' 
review. The guidance should also readdress the timing requirements for the monitoring reports 
or data queries and documentation retention; 
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2. Conduct periodic training to ensure that all port personnel have comprehensive knowledge of 
the CM program requirements; and 

3. Re- formalize and implement effective procedures for the port audit process performed by 
NASD, or readdress the self-inspection program to provide a more comprehensive and in-depth 
review of port activity (similar to what was accomplished under the previously performed port 
audits), including ensuring that the port is performing the reviews accurately. 

2. Bonded Warehouse and Foreign Trade Zones 
Background: 

Bonded Warehouses (BW) are facilities under the joint supervision of CBP and the BW proprietor used to 
store merchandise that has not made entry into U.S. commerce. 

Foreign Trade Zones (FTZ) are secured areas under the joint supervision of CBP and the FTZ operator 
that are considered outside of the CBP territory upon activation. Authority for establishing these facilities 
is granted by the U.S. Department of Commerce's Foreign Trade Zones Board under the Foreign Trade 
Zones Act of 1934, as amended (19 U.S.C 81a-81u). Foreign and domestic merchandise may be admitted 
into zones for operations not otherwise prohibited by law, including storage, exhibition, assembly, 
manufacturing, and processing. 

Condition: 

We noted the following internal control weaknesses related to the BW and FTZ processes: 

• CBP lacked the ability to maintain one centrally managed list of all BWs and FTZs; 

• Inconsistent procedures followed by the ports for completing the risk assessments and 
compliance reviews or lack thereof by the ports of completing the risk assessments and 
compliance reviews; and 

• Annual compliance review schedules are completed by the ports and provided to 
Headquarters once a year. The HQ retrieval and review of the surveys can take up to 6 
months to compile and analyze. 

Criteria: 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB 's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

Cause/Effect: 

CBP's current system ACS does not maintain a complete listing of BWs and FTZs. 
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In addition, port personnel were not aware of the requirements and were following outdated procedures 
for the risk assessments and compliance reviews. CBP-HQ cannot effectively monitor or determine the 
overall compliance of the BW/FTZ process if inconsistent procedures were being followed at the ports for 
completing the risk assessment and compliance reviews. 

Processes do not exist for the ports to provide on a timely basis the results of the BW/FTZ compliance 
review schedules and risk assessments to CBP-HQ for review. As a result, CBP-HQ cannot determine 
the effectiveness of the BW/FTZ program without the ability to track the results on a consistent timely 
basis from the ports. 

It is possible that BW/FTZ operators and users may be able to operate BWs and FTZs that contain 
merchandise about which CBP has no knowledge. 

Recommendations: 

We recommend that CBP: 

1 . Continue the current plan to compile a population of all BWs and FTZ's within ACE; and 

2. Ensure adequate communication of the ports requirements related to compliance reviews and risk 
assessments and provide effective timely training so that all responsible personnel are aware of 
and can consistently execute all of the requirements; and 

3 . Implement a compliance review schedule template to be utilized by all ports for transmission to 
CBP-HQ. Ensure timely response and review by HQ personnel. 



3. In-Bond Program 
Background: 

In-bond entries occur when merchandise is transported through one port; however, the merchandise does 
not officially enter U.S. commerce until it reaches the intended port of destination. An In-bond also 
allows foreign merchandise arriving at one U.S. port to be transported through the U.S. and be exported 
from another U.S. port without appraisement or the payment of duty. In 1998, CBP implemented a 
tracking and audit system within the Automated Commercial System (ACS). It was designed to provide "real 
time" tracking of in-bond shipments from origin to destination, including entry and exportation. This 
tracking and audit system also serves as a compliance measurement system through random examinations 
and port audit reviews to ensure compliance. The tracking and audit system was designed to prevent 
diversion of In-bond shipments being imported and exported. The tracking and audit system calls for 
randomly selected ports to perform physical examinations at the time of arrival and departure as well as 
for post audit reviews of carrier activity. 

Condition: 

We noted the following internal control weaknesses related to the In-bond process: 

• Inconsistent procedures followed by the ports for completing compliance reviews/audits of 
in-bond entries or the overall lack of the completion of such reviews/audits; 
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• Inconsistent review of required monthly reports related to in-bond activity at the ports and 
significant system limitations of the monthly reports which limit the overall usefulness; 

• CBP is unable to determine the status of the in-bond shipments with the information available 
within ACS; 

• National policies or procedures do not exist to monitor the results of in-bond audits; and 

• CBP has not implemented a CMP to measure the revenue gap and effectiveness of controls 
over trade compliance related to the In-bond process. 

Criteria: 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

Cause/Effect: 

In recent years, several new directives and a new handbook have been implemented for the in-bond 
program to address the performance of the program at the port level; however, there are currently no 
procedures in place to address headquarters' oversight of the program on a national level. 

The lack of an automatic compilation and analysis of audit results at the national level results in the 
inability to determine the overall effectiveness of the in-bond audits and weaknesses in the overall in- 
bond program will not be known or identified at the national level. 

Recommendations: 

We recommend that CBP: 

1. Communicate to the ports the requirements for the in-bond program and provide adequate 
training for appropriate personnel to ensure that the requirements are carried out accurately; 

2. Develop policies and procedures for the review of required monthly reports and address system 
limitations related to the required monthly reports to improve their usefulness. The policies and 
procedures should state how often the monthly reports are to be reviewed and the exact 
procedures to follow when completing the review; 

3. Implement a standard procedure to periodically compile the results of all in-bond audits 
performed during the year and develop an analysis function in order to evaluate importers' 
compliance with regulations as well as the overall effectiveness of the in-bond audits at a 
national level; and 

4. Consider the cost/effectiveness of implementing a CMP (revenue gap calculation) over in-bond 
to assess the risk of revenue loss and violations of trade regulations by importers. 
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4. Continued Dumping and Subsidy Offset Act of 2000 (CDSOA) Refunds 
Background: 

The Tariff Act of 1930, section 731 (19 U.S.C 1673), provides for the imposition of antidumping duties 
(AD) when the Department of Commerce's (DOC) International Trade Administration (IT A) determines 
that foreign merchandise is being sold to the U.S. at less than fair value. The International Trade 
Commission (ITC) determines whether the import of such merchandise threatened an industry in the U.S. 
with material injury, caused the establishment of an industry in the U.S. to be materially retarded, or 
caused an industry in the U.S. to be materially injured. The Continued Dumping and Subsidy Offset Act 
of 2000 (CDSOA) amended the Tariff Act of 1930 by adding a new section. Section 754 (see 19 U.S.C 
1675c) requires that, "...assessed duties... must be distributed to affected domestic producers for certain 
qualifying expenditures..." that were incurred after the issuance of the related duty order or finding. 

Public Law 109-171, section 7601 (a) repealed Section 754 related to good entered into U.S commerce 
after October 1, 2007. However, CDSOA refunds will continue for several years as the previous fiscal 
year entries liquidate and are refunded to the injured industry. 

When the ITC or ITA concludes its Antidumping review, antidumping duties are moved into a special 
account for distribution to injured domestic industries, or refunded to the importers against whom the 
duties were levied. 

At least 90 days prior to the end of a fiscal year, CBP is required to publish in the Federal Register a 
notice of intention (NOI) to distribute assessed duties received as the continued dumping and subsidy 
offset for that fiscal year. 

The NOI must indicate the total amount of funds available for distribution, the case name and the number 
of the particular order or finding, a list of domestic producers that would be potentially eligible to receive 
a distribution, and instructions for filing the certification to claim a distribution (19 C.F.R. § 159.62). 

Condition: 

During FY 2007, CBP began a process of validating and verifying (desk review began in 2007 and on-site 
began in 2005) CDSOA disbursement certification. However, statistical risk based verification was not 
completed with final analyzed results as the program is still in development. 

Criteria: 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

The Improper Payments Information Act of 2002 requires agencies to assess the risk of erroneous 
payments and develop a plan to correct control weaknesses. 
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Cause/Effect: 

CBP is required, by law, to examine each certification filed, calculate the amount disbursed to each 
claimant and make all disbursements within the first 60 days following the fiscal year in which the 
certification was filed. CBP is limited on time and resources to review all certifications that are 
submitted. 

CBP may make CDSOA disbursements based on incorrect certifications filed by injured domestic 
industries resulting in potential incorrect payments. Without proper verification of certifications being 
submitted, these erroneous claims may go undetected. 

Recommendation: 

CBP is currently in the process of developing a verification process for CDSOA disbursements. KPMG 
recommends that CBP continue with the development of this process in order to ensure compliance with 
the law. 

CBP Response: 

See management's response included in the attached letter. 
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Compliance with Laws and Regulations 

(Findings A - B and C are presented in Exhibits I and II, respectively) 

D. Federal Information Security Management Act (E-Government Act of 2002) 

CBP is required to comply with the FISMA, which was enacted as part of the E-Government Act of 2002. 
FISMA requires agencies and departments to: (1) provide information security for the systems that 
support the operations under their control; (2) develop, document and implement an organization-wide 
information security program; (3) develop and maintain information security policies, procedures and 
control techniques; (4) provide security training and oversee personnel with significant responsibilities for 
information security; (5) assist senior officials concerning their security responsibilities; and (6) ensure 
the organization has sufficient trained personnel to comply with FISMA requirements. We noted 
instances of non-compliance with FISMA that have been reported by us in Appendix I within Comment B 
-Information Technology. 

Recommendation: 

We recommend that CBP fully implement the requirements of FISMA in fiscal year 2008. 

E. Federal Financial Management Improvement Act of 1996 (FFMIA) 

CBP is required to comply with FFMIA, which requires that an agency's financial management systems 
substantially comply with Federal financial management systems requirements, applicable Federal 
accounting standards, and the United States Government Standard General Ledger at the transaction level. 
We noted instances of non-compliance with FFMIA in relation to Federal financial management systems 
requirements and the United States Government Standard General Ledger at the transaction level. 

Specifically, we noted the following weaknesses: 

1. With respect to Federal financial management system requirements, CBP's inventory 
transactions do not interface between the inventory systems and the financial system (SAP) and 
non-entity accounts receivable do not interface between ACS and SAP; and 

2. With respect to the United States Government Standard General Ledger at the transaction level, 
inventory activity (usage, turn-ins, interagency transfers) and non-entity accounts receivable are 
not recorded at the transaction level in SAP. Non-entity accounts receivable information is 
maintained in ACS, SAP, and on manually prepared schedules. ACS is made up of several 
financial modules that track receivables through entry or case number. Year-end balances are 
posted through the ACS/SAP interface and through manual calculations for receivables not 
recorded through the ACS/SAP interface. 

Recommendation: 

We recommend that CBP improve its processes to ensure compliance with the FFMIA in fiscal year 
2008. 

CBP Response: 

See management's response included in the attached letter. 
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Prior Year Condition 


As Reported at 
SeDtember 30 2006 


Status as of September 30, 2007 


Drawback of Duties, Taxes and 
Fees 


Material Weakness: ACS lacked controls 
to detect and prevent excessive drawback 
claims and payments, requiring inefficient 
manual processes to compensate and the 
drawback review policies did not require 
drawback snpcialists to review all related 
drawback claims. 


Continue as a material weakness: 

Weaknesses continue to exist related 
to the drawback process. See control 
finding letter A. 


Information Technology 


Material Weakness: Weaknesses 
were noted in entity-wide security, 
system access, segregation of duties, 
service continuity, and system software 
change management. 


Continue as a material weakness: 

Although improvements were made, 
weaknesses still remained in all areas 
noted during fiscal year 2007. See 
control finding letter B. 


Financial Reporting - Property, 
Plant, and Equipment 


Reportable Condition: Weaknesses were 
noted in the accountability of property, 
plant, and equipment. 


No longer considered a reportable 
condition. 


Financial Reporting - Intra 
Departmental Imputed 
Financing Costs 


Reportable Condition: Weaknesses were 
noted in CBP's ability to track and properly 
record in a timely manner all intra- 
departmental imputed financing costs. 


No longer considered a reportable 
condition. 


Financial Reporting - Financial 
Statement Presentation 


Reportable Condition: Weaknesses were 
noted in CBP's ability to properly prepare 
financial statements that complied with all 
reporting requirements of OMB A-136 and 
applicable federal accounting standards. 


No longer considered a reportable 
condition. 


Entry Process - Compliance 
Measurement Program 


Reportable Condition: Several 
weaknesses existed related to CMP, such as 
inconsistent procedures followed at the 
ports, reduced CMP sample size, lack of 
NASD port audits, and little review or 
analysis on the CM data to ensure that it 
was inputted correctly. 


Continue as a significant deficiency: 

Although improvements were made, 
weaknesses still remain during fiscal 
year 2007. See control finding letter 
D. 


Entry Process - Bonded 
Warehouse and Foreign Trade 
Zones 


Reportable Condition: Several 
weaknesses existed related to BW/FTZ, 
such as the lack of official guidance and 
training to address the monitoring of 
BW/FTZ, lack of management review of 
the BW/FTZ surveys, and the lack of a 
revenue gap calculation related to 
BW/FTZ. 


Continue as a significant deficiency: 

Weaknesses continue to exist related 
to the bonded warehouse and foreign 
trade zone process. See control 
finding letter D. 


Entry Process - In Bond 


Reportable Condition: Several 
weaknesses existed related to in-bond, such 
as the lack of official guidance and training 
to address the monitoring of in-bond 


Continue as a significant deficiency: 

Although improvements were made, 
weaknesses still remain during fiscal 
year 2007. See control finding letter 
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Prior Year Condition 


As Reported at 
September 30, 2006 


Status as of September 30, 2007 




shipments at the port level, lack of CBP- 
HQ review of the in-bond program, and the 
overall inability to determine the 
effectiveness of the in-bond program for 
CBP in its entirety. 


D- 


Non-compliance with the 
Federal Information Security 
Management Act 


Instance of non-compliance: CBP was not 

in substantial compliance with FISMA. 
FISMA requires agencies and departments 
to: 1) provide information security for the 
systems that support the operations under 
their control; 2) develop, document and 
implement an organization-wide 
information security program; 3) develop 
and maintain information security policies, 
procedures and control techniques; 4) 
provide security training and oversee 
personnel with significant responsibilities 
for information security; 5) assist senior 
officials concerning their security 
responsibilities; and 6) ensure the 
organization has sufficient trained 
personnel to comply with FISMA 
requirements. 


Continue reporting as an instance 
of non-compliance: Although 
improvements were made, CBP did 
not substantially comply with all 
categories of FISMA. See 
compliance finding letter E. 


Non-compliance with the 
Federal Financial Management 
Improvement Act of 1996 


Instance of non-compliance: CBP was 

not in substantial compliance with FFMIA, 
which requires that an agency's financial 
management systems substantially comply 
with Federal financial management systems 
requirements, applicable Federal 
accounting standards, and the United States 
Government Standard General Ledger at 
the transaction level. We noted instances of 
non-compliance with FFMIA in relation to 
Federal financial management systems 
requirements, the United States 
Government Standard General Ledger at 
the transaction level, and Federal 
accounting standards 


Continue reporting as an instance 
of non-compliance: Although 
improvements were made, CBP did 
not substantially comply with all 
categories of FFMIA. See 
compliance finding letter F. 


Non-compliance with the 
Improper Payments Act of 2002 
(IPIA) 


Instance of non-compliance: CBP was 

not in substantial compliance with IPIA, 
which requires agencies to review all 
programs and activities they administer 
annual and identify those that may be 
susceptible to significant erroneous 
payments. For all programs and activities 
where the risk of erroneous payments is 
significant, agencies must estimate the 
annual amounts of erroneous payments, and 
report the estimates to the President and 
Congress. We noted that CBP did not 
complete IPIA sampling and testwork as it 


No longer considered an instance of 
non-compliance. 
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Prior Year Condition 


As Reported at 
September 30, 2006 


Status as of September 30, 2007 




relates to custodial activity disbursements 
and as a result could not provide complete 
IPIA information to DHS. 





Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General (OIG) at 
(202) 254-4199, fax your request to (202) 254-4305, or visit the OIG web site at 
www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 
or noncriminal misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, Attention: 

Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller. 



